Download Full Issue in PDF - Academy Publisher

JOURNAL OF COMPUTERS, VOL. 8, NO. 6, JUNE 2013 1621
(g, g 1 , g 2 , h). Let mk be the master-secret key
and let params be the public parameters.
KeyGen IBE (mk, params, ID). Given
mk = g2 α and ID with params, the
PKG picks random s 0 , s 1 ∈ Zp, ∗ choose
a hash function ˜H : Zp ∗ × {0, 1} ∗ → Zp
∗
and computes u 0 = ˜H(s0 , ID),
u 1 = ˜H(s 1 , ID). Set sk ID = (d 0 , d 1 , d ′ 0) =
(g2 α (g1 ID h) u0 , g u0 , (g2 α (g1 ID h) u1 )). The PKG
preserves (s 0 , s 1 ).
Enc IBE (ID, params, M). To encrypt a message
M ∈ G 1 under the public key ID ∈ Zp,
∗
pick a random r ∈ Zp ∗ and compute C ID =
(g r , (g1 ID h) r , Me(g 1 , g 2 ) r ).
Dec IBE (sk ID , params, C ID ). Given ciphertext
C ID = (C 1 , C 2 , C 3 ) and the secret key
sk ID = (d 0 , d 1 ) with prams, compute M =
C 3e(d 1,C 2)
e(d .
0,C 1)
delegation scheme:
KeyGen PRO (sk R , params, ID, ID ′ ). The
PKG computes u ′ 1 = ˜H(s 1 , ID ′ ) and randomly
selects k 1 , k 2 , k 3 ∈ Zp ∗ and sets
rk ID→ID ′ = (rk 1 , rk 2 , rk 3 , rk 4 ) =
( αID′ +t 2+k 1
k 3(αID+t 2)
+ k 2 , g u′ 1 k3 , g u′ 1 k2k3 , g u′ 1 k1 ) and
sends them to the proxy via secure channel.
We must note that the PKG computes a different
(k 1 , k 2 , k 3 ) for every different user pair
(ID, ID ′ ).
Check(params, C ID , ID). Given the delegator’s
identity ID and C ID = (C 1 , C 2 , C 3 )
with params, compute v 0 = e(C 1 , g1 ID h) and
v 1 = e(C 2 , g). If v 0 = v 1 then output 1.
Otherwise output 0.
ReEnc(rk ID→ID ′, params, C ID , ID ′ ).
Given the identities ID, ID ′ , rk ID→ID ′ =
(rk 1 , rk 2 , rk 3 , rk 4 ) = ( αID′ +t 2+k 1
k 3(αID+t 2)
+
k 2 , g u′ 1 k3 , g u′ 1 k2k3 , g u′ 1 k1 ) with params, the
proxy re-encrypt the ciphertext C ID into
C ID ′ as follows. First it runs “Check”, if
output 0, then return “Reject”. Else computes
C 2ID ′ = (C 1, ′ C 2, ′ C 3, ′ C 4, ′ C 5, ′ C 6, ′ C 7) ′ =
αID ′ +t 2 +k 1
k
(C 1 , C 2 , C 3 , C
(αID+t 2 ) +k2
2 , rk 2 , rk 3 , rk 4 ).
Dec1 IBE (sk ID ′, params, C 2ID ′). Given
a re-encrypted ciphertext C 2ID ′ =
(C 1, ′ C 2, ′ C 3, ′ C 4, ′ C 5, ′ C 6, ′ C 7) ′ and the secret key
sk ID = (d 0 , d 1 , d ′ 0) with params, computes
C
M =
3e(C ′ 5, ′ C 4)
′
e(C 2 ′ , C′ 6 )e(C′ 1 , C′ 7 )e(d′ 0 , C′ 1 )
C
=
3e(rk ′ 2 , C 4)
′
e(C 2 ′ , rk 3)e(C 1 ′ , rk 4)e(d ′ 0 , C′ 1 )
Dec2 IBE (sk ID ′, params, C 1ID ′). Given a
normal ciphertext C ID ′ = (C 1 , C 2 , C 3 ) and the
secret key sk ID ′ = (d 0 , d 1 , d ′ 0) with prams,
compute M = C3e(d1,C2)
e(d . 0,C 1)
We
Remark
computes
pair
+t 2+k
3(αID+t
same
not secure
Security
Theorem
our
IND-sID-CPA
colluding.
Proof:
construct
On
output
= g
interacting
Initialization.
with
intends
Setup.To
rithm
h
params
ing
g2 a
Phase
•
•
can verify its correctness as following
C 3e(rk ′ 2 , C 4)
′
e(C 2 ′ , rk 3)e(C 1 ′ , rk 4)e(d ′ 0 , C′ 1 )
Me(g 1 , g 2 ) r e(g k3u′ 1 , (g
ID
=
1 h) r( αID′ +t 2 +k 1
k 3 (αID+t 2 ) +k2) )
e((g1 IDh)r
, g u′ 1 k2k3 )e(g r , g k1u′ 1)e(g2 α(gID′
1 h) u′ 1, g r )
= Me(g 1, g 2 ) r e(g k3u′ 1 , (g
ID
1 h) k2r )e(g k3u′ 1 , (g
ID ′
1 h) r
e((g1 IDh)r
, g u′ 1 k2k3 )e(g r , g k1u′ 1)e(g2 α(gID′
= Me(g 1, g 2 ) r
e(g2 α, = M
gr )
2: In our scheme, we must note that the P-
a different (k 1 , k 2 , k 3 ) for every different
(ID, ID ′ ). Otherwise, if the adversary knows
1
2) 2 for five different pairs (ID, ID ′ ) but
k 1 , k 2 , k 3 , α, t 2 , he can compute (α, t 2 ), which
at all.
Analysis
1: Suppose the DBDH assumption holds,
scheme proposed in Section III-C is DGA-IBEsecure
for the proxy and the delegatee’s
Suppose A can attack our scheme, we
an algorithm B solves the DBDH problem in
input (g, g a , g a2 , g b , g c , T ), algorithm B’s goal
1 if T = e(g, g) abc and 0 otherwise. Let
, g 2 = g b , g 3 = g c . Algorithm B works by
with A in a selective identity game as follows:
The selective identity game begins
A first outputting an identity ID ∗ that it
to attack.
generate the system’s parameters, algo-
B picks α ′ ∈ Z p at random and defines
= g1 −ID∗ g α′ ∈ G. It gives A the parameters
= (g, g 1 , g 2 , h). Note that the correspond-
master − key, which is unknown to B, is
= g ab ∈ G ∗ .
1
“A issues up to private key queries on
ID i ”. B selects randomly r i , r ′ ∗
i ∈ Z p
and k ′ ∈ Z p , sets sk IDi = (d 0 , d 1 , d ′ 0) =
−α ′
ID
(g i −ID ∗
2 (g (IDi−ID∗ )
1 g a ) ri −1
ID
, g i −ID ∗
2 g ri ,
−α ′
ID
g i −ID ∗
2 (g (IDi−ID∗ )
1 g a ) r′ i). We claim sk IDi
is a valid random private key for ID i .
b
To see this, let ˜r i = r i −
ID−ID
and
∗
˜r i ′ = r′ i − b
ID−ID
. Then we have that
∗
−α ′
ID
d 0 = g i −ID ∗
2 (g (IDi−ID∗ )
1 g α′ ) ri =
g2(g a (IDi−ID∗ )
1 g α′ ) ri− b
ID−ID∗
= g2(g a IDi
1 h) ˜ri .
−1
ID
d 1 = g i −ID ∗
2 g ri = g ˜ri .
−α ′
d ′ ID
0 = g i −ID ∗
2 (g (IDi−ID∗ )
1 g α′ ) r′ i
=
g2(g a (IDi−ID∗ )
1 g α′ ) r′ i − b
ID−ID∗
= g2(g a IDi
1 h) ˜r i ′ .
“A issues up to rekey generation queries on
(ID, ID ′ )”.
The challenge B chooses a randomly x ∈ Zp,
∗
2)
KG
3)
αID ′
k
the
is
4)
D.
• The then
1)
G.
is to
g a 1
1)
2)
2)
3)
3)
4)
5)
k 3 )e(g k3u′ 1 , g
k 1 r
1 h) u′ 1, g r )
k 3 )
© 2013 ACADEMY PUBLISHER